jfrog / jfrog/jfrog-cli-security

jf audit command hangs after finding violations in v2.88.0

Open
#638 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

The jf audit command hangs and doesn't exit cleanly after finding violations in version 2.88.0, causing GitHub Actions workflows to timeout and fail. This issue did not occur in v2.87.0.

Environment
  • JFrog CLI Version: 2.88.0
  • Previous Working Version: 2.87.0
  • Platform: GitHub Actions (Linux runner)
  • Node Version: 16.20.2
  • Project Type: npm + Maven (multi-technology project)
Current behavior
Actual Behavior

The command:

  1. Successfully scans both Maven and npm dependencies
  2. Reports violations: Found 2267 violations: [150 SCA, 2117 Operational Risk]
  3. Hangs and never exits, causing the GitHub Actions step to remain "in progress"
  4. Eventually causes the workflow to timeout and fail
Reproduction steps
Steps to Reproduce
  1. Set up a GitHub Actions workflow with JFrog CLI v2.88.0
  2. Run jf audit on a project containing both npm and Maven sub-projects
  3. Ensure the project has dependencies with violations
  4. Observe the command output
Expected behavior
Expected Behavior

The jf audit command should:

  1. Complete the scan
  2. Report violations
  3. Exit cleanly with appropriate exit code (exit code 0 for no violations, or exit code 3 when violations fail the build)
  4. Allow the GitHub Actions workflow to proceed to the next step
JFrog CLI-Security version

2.88.0

JFrog CLI version (if applicable)

2.88.0

Operating system type and version

linux

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the jf audit command in a Linux GitHub Actions workflow with both npm and Maven sub-projects, using versions 2.87.0 and 2.88.0 for comparison. Inspect the audit command's behavior after it reports violations, especially whether it reaches the expected exit code. Done means the scan reports violations and exits cleanly with code 0 or 3 instead of hanging.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
ci-cd, cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.